CVE-2026-91016 — Motors < 1.4.121 - Unauthenticated Draft/Private Listing Disclosure
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated …
Published: 2026-09-17 · CVSS: 5.3 · CVSS 3.1
The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7